Bug #1037

Remote Code Execution via UTF-8 extended characters

Added by jakbu over 2 years ago. Updated over 2 years ago.

Status:Fixed% Done:

100%

Priority:ImmediateSpent time:-
Assignee:-
Category:Client
Target version:2.76
OS: Arch:

Description

Writing UTF-8 characters doesn’t work properly on team chat and fireteam chat. Writing "żółć" for example can manipulate mouse (mouse moves ingame, uses scroll to change weapons, shoots the gun). Writing ó on the end game screen writes ×
actually and posts various strings into chat window.


Related issues

Related to ET: Legacy Development - Bug #981: Some characters don't appear in chat Confirmed 31.01.2017

Associated revisions

Revision 63ab650c
Added by IR4T4 over 2 years ago

Merge pull request #273 from isRyven/master

misc: fix utf/extended ascii symbols in commands caused unexpected behavior refs #1037

Revision e29ea3d5
Added by IR4T4 over 2 years ago

qcommon: don’t allow extended ascii values in MSG_Read String functions refs #1037 - patch by ioq3

History

#1 Updated by tomich over 2 years ago

I can confirm this issue with the following clients tested:

- Windows
- Linux 32bit
- Linux 64 bits
- Mac

If I type áúíàùì in team chat some red dots appear on chat but also my character fires the weapon and looks up.

Edit:

I tested connecting to a ETL 2.75 i386 server running on Linux x86_64

#2 Updated by tomich over 2 years ago

  • Category set to Client
  • Priority changed from Normal to Urgent

User jakbu also found out this, that would make this a high priority bug and turn this into an exploit.

When you type óóóó in team chat, all your non bot teamates are affected in movement.
- They all fire their weapons. (confirmed by me also)
- They all look at the sky. (confirmed by me also)
- They cannot run (not confirmed by me yet)

The obvious: This would mean that by typing in chat, you can affect your teammates (non bot) movement and would make this bug an exploit.

I only tested this addendum on a Linux 64 bit client with another linux 64 bit client. Didn’t have time to test on Windows, Mac or 32bit Linux but I assume this affects all platforms. Jakbu tested on Windows.

Also. In this bug system, you should add an option "All platforms" to the OS section.

Tom

#3 Updated by jakbu over 2 years ago

  • Category deleted (Client)
  • Priority changed from Urgent to Normal

Works globally sometimes, when characters break on global chat they affect everyone.

#4 Updated by jakbu over 2 years ago

  • Category set to Client
  • Priority changed from Normal to Urgent

#5 Updated by jakbu over 2 years ago

Typing special characters by rcon affects everyone. Changing name to the one with special characters affects everyone.

#6 Updated by IR4T4 over 2 years ago

  • Status changed from New to Invalid
  • Priority changed from Urgent to Normal
  • % Done changed from 0 to 100

Duplicate see #981

#7 Updated by IR4T4 over 2 years ago

  • Related to Bug #981: Some characters don't appear in chat added

#8 Updated by tomich over 2 years ago

  • Subject changed from UTF-8 characters to Remote Code Execution via UTF-8 extended characters
  • Priority changed from Normal to Immediate

I think IR4T4 did not understand this issue. Please change Status to active.

I changed the subject to reflect the criticality.

IR4T4 , let me be clear with this issue:

By inputing characters in global chat/team chat or console, you can make ALL the other players move, shoot and do things.

If someone were to make a one line script that connects to every ETL public server, it would ruin every public game.

This started as an issue with characters not being displayed, but is clearly now an exploit and should be taken seriously.

Cheers

Tom

#9 Updated by IR4T4 over 2 years ago

  • Status changed from Invalid to New
  • % Done changed from 100 to 0

#10 Updated by IR4T4 over 2 years ago

  • Target version set to 2.76

Alright, this reminds me at an old NQ issue where players with UTF chars in name cause a foot kick for all other players on connect.

#11 Updated by IR4T4 over 2 years ago

  • Status changed from New to Fixed
  • % Done changed from 0 to 100

This issue should be fixed - see related commits.

Also available in: Atom PDF